DDoS attack traffic identification and detection method in SDN (Software Defined Network)

Abstract

The invention discloses a DDoS attack traffic identification and detection method under an SDN. The method comprises the following steps: S1, collecting flow table information; S2, calculating a traffic characteristic value with DDoS attack characteristics according to the traffic table information, and converting the traffic characteristic value into characteristic vector data; s3, utilizing the characteristic vector data to construct a random forest model, adopting the constructed random forest model to screen the traffic characteristics with little effect of identifying the DDoS attack, and obtaining an optimal characteristic subset; S4, converting the optimal feature subset into a feature vector Fnew, measuring the feature vector Fnew and the Mahalanobis distance of each node in the feature mode graph, if a node having the nearest Mahalanobis distance with the feature vector Fnew exists, determining that the feature mode corresponding to the node is the category of the feature vector Fnew, and if the category is a benign category, determining that the traffic is normal; otherwise, determining that the traffic is the DDoS attack traffic.

Description

technical field [0001] The invention relates to the technical field of computer network security, and more specifically, relates to a method for identifying and detecting DDoS attack traffic under an SDN network. Background technique [0002] As a future network architecture, the SDN network realizes the separation of the control plane and the forwarding plane. Users can dynamically adjust their own forwarding strategies through the controller according to business requirements, which is highly flexible. But it is precisely because of this characteristic of the SDN network architecture that the controller becomes the center of the entire network and is vulnerable to various network attacks. [0003] DDoS attack is one of the main threats to controller security. When a DDoS attack occurs, the attacker controls the zombie host in the network and sends a large number of invalid network data packets to the network. If there is no matching flow item in the table, these data pack...

AI Technical Summary

Problems solved by technology

[0007] Therefore, in the face of complex and changeable network traffic in an SDN network, how to more comprehensively and accurately extract the characteristics of DDoS attack traffic and use these features to identify DDoS attack traffic more quickly is challenging.

Images